Threats Tagged 'ghsa-8mvp-fqvr-fj7j'

A vulnerability in the Linux kernel's RISC-V KVM implementation was resolved involving an overflow in the PMU event info array size calculation. The issue arises because the number of events multiplied by the size of each event is stored in a 32-bit integer, causing truncation on RV64 architectures. This leads to out-of-bounds reads and writes when KVM allocates insufficient memory but loops over the original large event count. The flaw was triggered by a nested guest and detected by KASAN as a slab-out-of-bounds error. The fix involved using size_t for size storage, rejecting multiplication overflow, and safer memory allocation methods.